globaleaks/GlobaLeaks — Issue #96: Harden web2py
Author: hellais
Created: 2011-10-26 13:28:13+00:00
State: open
Labels: Security

Since GlobaLeaks will be running as a Tor HS web2py will be running binded to 127.0.0.1.
This means that he thinks that all connections are coming from a "trusted" source (localhost).

We need to make him understand that even if connections are coming from localhost it is not a trusted environment.

For example when connecting from localhost the admin interface is enabled, this should be disabled.
This issue may be solved with this: http://web2py.com/AlterEgo/default/show/68

Are there other occasions where connection from localhost is exposing security vulnerabilities?